We recommend updating to this version of the SDK for security enhancements.
Security
Updated OkHttp to 4.12.1 to address CVE-2026-111943. This protects the SDK’s network connections, including on devices without Google Play services.
Updated core security, code protection, and payment kernel dependencies.
New Features
Added support for JCB cards.
TransactionFailed.tapToPayException now includes the backend error details. PaymentException.ErrorAction has new acquiringErrorTextId and acquiringErrorDescription fields.
Preparation for Girocard support, rolling out in coming weeks.
Fixes
Fixed a crash (NoSuchMethodError) on the SDK’s first network request in host apps built with R8 obfuscation. This affected versions 1.1.5 and 1.1.6.
When the card type (credit/debit) doesn’t match, the cardholder can now re-tap up to 3 times, as intended, instead of once.
Fixed a crash when the PIN entry security library failed to load. The payment now fails with an error instead.
Improved reliability on devices that don’t deliver sensor events.
Fixed an out-of-memory issue caused by metrics recording.
Integration Notes
This release contains breaking API changes. Code that passes affiliateData = null or uses shouldDisplayReceipt no longer compiles.
CheckoutData.affiliateData is now required. Pass an AffiliateModel with your app’s affiliate key so transactions are attributed to your integration.
PaymentFlowClosedSuccessfully.shouldDisplayReceipt has been removed, as announced in 1.1.6. Remove any references to it.
The SDK’s consumer ProGuard rules no longer disable code shrinking (-dontshrink) or apply global keep rules to all enums and native methods in your app. If your release build relied on these, test it before shipping.
Redesigned the payment UI (success, error, warning, loading, and tap-card screens), including updated animations and PIN-pad styling.
When a presented card cannot be used, the SDK now prompts the cardholder to try another card instead of failing the payment immediately.
After repeated unsuccessful “try another card” attempts, the payment fails with PaymentException.CardErrorNotAccepted (code 1029).
Fixes
Fixed an issue that could send the charge request twice after a network interruption.
Fixed an issue where a transaction that had already failed on the backend might not notify the integrator with TransactionFailed.
Fixed a PIN-pad issue on some devices where digit 0 was not visible.
Integration Notes
The Send receipt button has been removed from the SDK success screen. Receipts must be handled by the host app if required.
PaymentFlowClosedSuccessfully.shouldDisplayReceipt is deprecated, always emitted as false, and will be removed in 1.1.7. Existing two-argument constructors still compile.
skipSuccessScreen is unchanged. Hosts that already show their own success UI are unaffected.
If you use an exhaustive when on PaymentException, add a branch for PaymentException.CardErrorNotAccepted.
Important — dependency and toolchain
The SDK is now built with Kotlin 2.2.21. Host apps compiling with Kotlin 1.9.x are likely to fail with a Kotlin metadata version mismatch. Upgrade the host Kotlin Gradle plugin to 2.0+ (2.2.x recommended) before integrating 1.1.6.
We recommend updating to this version of the SDK for security enhancements.
New Features
Added optional timeoutCardWaitSeconds to startPayment, allowing integrators to configure how long the SDK waits for card presentation.
The default card-wait timeout is now 240 seconds. Supported values are clamped between 60 and 240 seconds.
Updated SDK build support for Android 16 / API 36.
Updated core security, attestation, obfuscation, and payment kernel dependencies.
Fixes
Fixed an issue where rotating the device during an active transaction could interrupt the payment flow.
Fixed a recovery issue where transactions could keep failing with “Could not connect to the server” after a temporary network failure until the app was restarted.
Improved NFC card-read handling by retrying after supported L1 read errors.
Integration Notes
Existing integrations continue to work without code changes.
Integrators can optionally pass timeoutCardWaitSeconds when starting a payment to customize the card presentation timeout.
Added support of Online Pin SCA (Strong Customer Authentication).
Added card data to PaymentEvent.TransactionDone event: card type, card scheme, last four digits, and merchant code.
Transparent attestation process. The SDK now returns error details if attestation fails in PaymentEvent.TransactionFailed event. This helps developers understand and resolve attestation issues more effectively.
API changes to make it more concise. Now TapToPay.startPayment() function returns Flow<PaymentEvent> instead of Flow<Result<PaymentEvent>>.
Mitigated threats are now filtered out during attestation. If a threat has "mitigated": true, it is excluded from the threat list that is used to determine whether the COTS is attested.